You'll notice
Settings writes re-check for policy locks and reload first, so a remote write cannot override a locked managed policy.
Settings writes now re-check for policy locks before applying: a new helper checks whether a setting is locked and not writable-while-locked (excluding source: "managed"), reloading settings before writing if so. This hardens remote settings writes against overriding locked managed policies.